use api.server as pref name; store token and cookie as pref (maybe not needed later); fix using the proper server pref for requests